Главная
Study mode:
on
1
Intro
2
Windows Event Logs? Really?
3
Windows Event Forwarding
4
How many logs (EPS) are we talking about?
5
Description of our Cuckoo Malware Lab
6
Alerting vs. Exploring
7
Continued... (Deep Panda Sample)
8
Adding Local Admin
9
Event Tracing for Windows
10
PowerShell
11
AD: Right to Control All Users
12
Monitoring Your Monitoring
13
One-offs, Gotchas, and Recommendations
14
Questions?
Description:
Explore Windows Event Logs in-depth through this comprehensive conference talk from Bloomcon 2017. Delve into topics such as Windows Event Forwarding, log volume management, and the implementation of a Cuckoo Malware Lab. Learn about the differences between alerting and exploring logs, analyze real-world examples like the Deep Panda sample, and understand the importance of monitoring local admin additions. Discover Event Tracing for Windows, PowerShell logging, and Active Directory monitoring techniques. Gain insights into monitoring your monitoring systems, and receive valuable one-offs, gotchas, and recommendations from experts Nate Guagenti and Adam Swan. Enhance your cybersecurity skills and learn how to leverage Windows Event Logs effectively in this informative 56-minute presentation.

Windows Event Logs - Zero to Hero

Add to list
0:00 / 0:00